In
India, a massive effort is underway to collect biometric identity
information for each of the country’s 1.2 billion people. The incredible
plan, dubbed the “mother of all e-governance projects” by
the Economic Times, has stirred controversy in India
and beyond, raising serious concerns about the privacy and security of
individuals’ personal data.
The plan is moving ahead at a clip under the
auspices of the National Population Register (NPR) and the Unique ID
(UID) programs, separately governed initiatives that have an agreement
to integrate the data they collect to build the world’s largest
biometric database. Upon enrollment, individuals are issued 12-digit
unique ID numbers on chip-based identity cards. For residents who lack
the necessary paperwork to obtain certain kinds of employment or
government services, there’s strong incentive to get a unique ID. While
the UID program is voluntary, enrollment in the NPR program is mandatory
for all citizens.
The NPR program's stated
objectives are to streamline the delivery of government services
such as welfare or subsidies, prevent identity fraud, and facilitate
economic development, but some critics contend that the plan has its
roots in an agenda focused on national
security. Indian journalist Aman Sethi argues in a New York
Times Op-Ed that the NPR
The UID program is administered by the Unique
Identity Authority of India (UIDAI), an executive body created to
oversee the issuance of unique ID numbers for the stated purpose of
facilitating access to benefits and services. At the helm of UID is Nandan Nilekani,
a billionaire who made his fortune in the tech industry before
ascending to his current role as chairman of the UIDAI.
While the NPR program has been moving ahead
since 2004 with a relatively low level of public opposition, the more
recently introduced UID project has sparked controversy. UID took center
stage during a political feud last December when Parliament’s Standing
Committee on Finance rejected a bill establishing the National
Identification Authority of India, which would have granted the UID
program statutory mandate. Although the bill was submitted in 2010, the
UIDAI had already begun processing individuals and issuing numbers
pending Parliamentary approval of the legislation, operating under the
authority of the executive branch. The committee rejected the reasoning
that they had the authority to do so, calling the program’s legality
into question.
In late January, a compromise deal was struck
between the NPR and the UID program administrators following a
political turf war, when officials announced “the NPR and UID projects
would proceed side by side to ensure that all Indian citizens have a
unique number by June 2013.” Project administrators from UIDAI and India’s
Ministry of Home Affairs, which oversees the Indian Census and the NPR
program, announced
that they would collaborate to de-duplicate the data to
eliminate overlap for integration purposes.
Collecting Biometric Data
To date, some 170 million individuals have
been registered
in the UID program. To perform the data collection, the UIDAI has
executed Memoranda of Understanding (MOU) with partners -- including
states, union territories and 25 financial institutions -- to act as
registrars for implementing the scheme, according to a Parliamentary
committee report.
The registrars, in turn, contract with tech
firms such as Wipro, a company that has issued at least 6 million UID
numbers in Maharashtra. Agents gather the data by going from village to
village to set up processing
camps, toting laptops and scanning equipment along with them and
scrambling to process as many individuals as possible each day. In
addition to demographic information, individuals’ biometric information
is collected with iris scanners, fingerprint scanners, and face cameras
that employ facial recognition technology.
Morpho, a technology company, is a primary UID
contractor that develops and maintains systems to crosscheck new
applications by sifting through the biometrics database and prevent
actual or fraudulent duplication.
The UID program is known as Aadhar, which
also refers to the unique 12-digit number citizens are issued upon
enrollment. According to recent news reports, a pilot program will link
Aadhar with financial and banking services in 50 districts in a move
that the UIDAI program director says will “change
the financial landscape of the country.”
Nilekani has championed
the UID program as a tool that can aid low-income sectors of India’s
population by streamlining the delivery of public services and creating a
system that is more inclusive to the poor. Yet R. Ramakumar of the Tata
Institute of Social Sciences in Mumbai pushes back against this point
in an op-ed
in The Hindu, charging, “the UID would be an alibi
for the state to leave the citizen unmarked in the market for social
services.”
And if the interviews with Delhi’s poorest
residents in this
report is any indication, there’s also a danger that some
marginalized individuals could slip through the cracks altogether.
An issue of greater concern, however, is that
the biometric database could open the door to significant violations of
personal privacy. The Aadhar system became mired in controversy last
December surrounding the Parliamentary Standing Committee on Finance’s
rejection of legislation that would have given it statutory mandate. In a
report, lawmakers based their disapproval on concerns
about security, data theft and the fact that that a national data
protection law has yet to be enacted.
“The collection of biometric information and
its linkage with personal information of individuals without statutory
amendment appears to be beyond the scope of subordinate legislation,”
committee members wrote.
They also seized on the risk, uncertainty,
and potential for privacy violations that would be ushered in under the
massive scheme:
“Considering the huge database size and possibility of misuse of information, enactment of a national data protection law, which is at a draft stage, is a prerequisite for any law that deals with large scale collection of information from individuals and its linkages across separate database…The committee is afraid that the scheme may wind up being dependent on private agencies…”
Despite these concerns, the UID program
continues, while at the same time, biometric data collection for the NPR
moves ahead on a separate track. Mandatory registration
for all citizens in the NPR went into effect with the 2004 amendment of
the Citizenship Act, providing that “the Central Government
may compulsorily register every citizen of India and issue National
Identity Card[s].”
Civil Society Responds
The Center for Internet and Society (CIS) has criticized the
system due to design flaws that pose security and privacy concerns. "We don’t need Aadhar because we already have a much more robust identity management and authentication system based on digital signatures that has a proven track record of working at a ‘billions-of-users scale on the Internet with reasonable security,” CIS Director Sunil Abraham noted in a Business Standard op-ed. “The UID project based on the so-called ‘infallibility of biometrics’ is deeply flawed in design. These design disasters waiting to happen cannot be permanently thwarted by band-aid policies.
"Biometrics are poor authentication factors because once they are compromised they cannot be re-secured unlike digital signatures. Additionally, an individual’s biometrics can be harvested remotely without his or her conscious cooperation. The iris can be captured remotely without a person’s knowledge using a high-res digital camera." (For more detailed information on CIS's work on India's UID program, see here, here, here, here, here, and here.
Delhi-based NGOs have also condemned
UID as an affront to civil liberties that violates
citizens' basic constitutional right to privacy.
In his Op-Ed, Ramakumar echoes Indian
economist Amartya Sen in arguing that the system could open the door to
abuse by law enforcement:
“There is a related concern: police and
security forces, if allowed access to the biometric database, could
extensively use it for regular surveillance and investigative purposes,
leading to a number of human rights violations. As Amartya Sen has
argued elsewhere, forced disclosure and loss of privacy always entailed
‘the social costs of the associated programs of investigation and
policing.’ According to him, ‘some of these investigations can be
particularly nasty, treating each applicant as a potential criminal.’"
Meanwhile, famed activist Arundhati Roy voiced scathing criticism against India’s biometric collection scheme, saying, “The UID is a corporate scam which funnels billions of dollars into the IT sector. To me, it is one of the most serious transgressions that is on the cards. It is nothing more than an administrative tool in the hands of a police state.”
It is irrationally excessive to collect this
sensitive biometric data in a centralized nation-wide ID scheme. The
massive collection of biometric information in a centralized ID scheme
is not necessary nor proportionate in a democratic society.
EFF has documented (here,
here,
and here)
the function creep risks that this data collection poses to privacy and
security, including in those countries with data protection laws like
the European Union. Informed analysis of the long-term consequences of
the misused and secondary uses of this data collection and its impact in
people’s lives should have been given to all citizens before the
collection even started. There is still time to ask the Indian
government to dismantle that colossal database, like
the UK did.
